Everyone wants a piece of us, specifically a DNA sample. Private marketers assure us that our DNA will unlock useful secrets that can make our lives better by helping to determine what food we should eat, what drugs we should take, and even whether or with whom we should have children. We are encouraged to have our DNA decoded to discover our ancestry, and even mass marketed magazines, like National Geographic, encourage readers to submit their DNA samples for analysis to determine "where we come from." Federal and state officials discuss a national, or even international, DNA databank that can be used to hunt for criminals, and sometimes also to help exonerate criminal suspects. The promises of DNA testing seem endless to both individuals and society. But DNA testing has a dark side as well. As the source of genetic information, the DNA molecule is also a separate entity that can be collected and stored for multiple, currently unknown (or at least unconsented to) uses. Since multiple copies can readily be made, once an individual's sample is obtained, no further contact with the person is required to procure additional material for testing. Should this be of concern to us, or do existing federal and state laws adequately protect our genetic privacy?

In May 2006, the Secretary's Advisory Committee on Genetics, Health, and Society (SACGHS) issued a draft report on a proposed national biobank at the National Institutes of Health (NIH).[1] Similar to biobanks in other countries, such as the U.K., Estonia, and Canada, this repository would contain tissue samples and health information from 500,000 to 1,000,000 individuals to be utilized for studying the gene-environment interactions underlying common, complex diseases. During the preparation of its final report, SACGHS asked for public comments on several issues, including the privacy implications of biobanking and ownership of samples and data. How public input will affect the federal government's decisions regarding a national biobank remains to be seen. Federal officials seem to want to exercise caution before collecting DNA from a significant part of the population, and appear committed to protecting the interests of Americans who contribute samples and information for use in research. It would be a mistake, however, for the public to think that a future national biobank presents the principal risk to their genetic privacy or that the federal government has taken, or will take, sufficient action to protect their interests in regard to DNA banking. The fact is that DNA samples are currently routinely collected and used in multiple arenas with little legal restraint or regulatory oversight at the federal level. In this article we focus on developments in DNA banking in relation to genetic research and the expansion of commercial testing services to illustrate why current laws are inadequate to protect individual interests affected by DNA banking.

Banking Practices in Genetic Research

Throughout the 1990's, those most actively involved with collecting DNA samples from individuals (other than law enforcement officials and the U.S. military) were researchers intent on discovering genetic markers, primarily associated with relatively rare diseases. Typically, researchers collected DNA samples and information from families at risk for the disease of interest and analyzed the samples in an effort to understand the heritability of the disease. In the event that their endeavors proved successful and a disease marker was identified, additional research using the same samples would inevitably follow. Therefore, it became customary for researchers to seek consent when samples were collected to store DNA beyond the completion of initial research for use in subsequent studies of the same disease. As knowledge about the human genome advanced and attention became focused on exploring the role of genetics in more common diseases, research studies were structured in keeping with that broader goal. Consequently, researchers sought samples from a larger segment of the general population, anticipating that they would be useful in a variety of studies. The exploratory nature of this research made it difficult to describe any specific details about the focus of secondary studies and exactly how samples would be used in the future. Consequently, consent documents relating to the initial sample collection customarily stated that, by consenting to participate in research, subjects acknowledged that samples they provided would become the property of the researcher (or the institution where the research took place), who could use the samples for their own benefit. In this way, individuals who relinquished their samples were transformed from research subjects into donors and the consent-for-research forms morphed into documents effectuating gifts. To appreciate the significance of this phenomenon it is important to consider the nature of DNA samples, principles traditionally applied to research and the court's ruling in the case of The Washington University v. Catalona.[2]

The DNA sample can be viewed as a "future diary," or even a coded probabilistic medical record.[3] Possession of an identifiable DNA sample gives the possessor access to a wealth of information about the individual as well as his or her genetic relatives. This includes information that has been made derivable due to advances in genetics that occur after the sample has been relinquished. It is therefore unlikely that a person can be cognizant of, or fully appreciate, the informational value of his or her DNA sample at the point in time that it is relinquished to others. It also means that, as long as personally identifiable samples are stored, there is the possibility that those with access to the samples will discover things about individuals that the individuals themselves do not know, and most importantly, would not want others to know about them. In other words, unless those with access to samples refrain from using samples for any unauthorized purposes and destroy samples as soon as authorized uses have been completed or upon request of the sample's source, invasions of genetic privacy are inevitable.

The most basic principle of research with human subjects is that participation must be voluntary and the subject free to withdraw at any time. Researchers are therefore legally and ethically obligated to abide by requests from subjects to withdraw their tissue samples from research. However, this may no longer be the case, at least according to one lower federal court judge. In 2003, patients who had previously provided tissue samples for prostate cancer research conducted by Dr. William Catalona at Washington University wrote to the University requesting that their samples be removed from the University's tissue bank and released to Dr. Catalona, who had moved to Northwestern University.[4] In response, Washington University brought legal action seeking a determination that it owned the samples, and was not obligated to comply with the subjects' instructions. In ruling in favor of the University, the judge relied on the act of handing samples over to researchers as evidence that a "gift" had been made under Missouri law.

It was determined that ownership of the samples had been transferred to the University, and the judge was dismissive of provisions in the relevant consent forms. In keeping with established research rules, the forms included statements about the voluntary nature of participation and procedures for termination of participation. In regard to those provisions, the judge stated that "the right to discontinue participation in a research project means nothing more than that the [research participant] has chosen not to provide any more biological materials pursuant to one or more research protocols; i.e., not to make any more inter vivos gifts of donated biological materials to [Washington University]."[5] Since this was a ruling in federal district court, the case has little legal precedent and it may very well be that other courts faced with similar claims may not adopt the flawed reasoning of this court. Nevertheless, it presents a cautionary lesson to all individuals who have provided samples for genetic research under similar circumstances: if you relinquished a DNA sample to be banked for research, you may very well have made a gift under the law of your state and thereby lost control over your sample.

There is nothing in the Catalona case to indicate that the outcome would have been any different if the patients had given their samples to a repository operated by a for-profit corporation rather than a private academic research institution. So the thousands of individuals who have contributed samples to entities like the Ardais Corporation or DNA Sciences, which obtain samples either from patients at medical centers or through appeals over the internet for the express purpose of selling them to researchers, should also be concerned about what may happen to their DNA samples (and thus their genetic information) as a result of this case.

Those who have contributed samples for research might take some comfort from the fact that ownership of a DNA sample by a researcher does not necessarily relieve the researcher of his or her obligations (at least under the federal regulations governing research) to maintain confidentiality and protect the privacy of subjects. Thus, federal law may yet provide some protection against unauthorized disclosures of private genetic information by researchers. Nevertheless, those disclosure rules would not put limits on what information the owner could derive from the sample. In that sense, invasions of genetic privacy are very likely to result from donation of samples. This is important because one of the basic reasons for protecting genetic privacy is to guard against secret genetic testing that would result in someone else knowing more about an individual's genetic status than that individual knows her or himself, or would choose to have others know.

Commercial Testing and DNA Banking

Direct-to-consumer marketing of genetic tests, and the collection of samples in relation to such testing, presents additional opportunities for invasions of genetic privacy. In this context federal laws that might restrict misuse of samples by researchers are of course irrelevant and no federal law addresses genetic privacy in other contexts. Consequently, individuals who send samples directly to laboratories for testing must look to state laws for rules governing the collection and uses of DNA samples. By 2000, a majority of states had enacted laws regulating genetic testing and fair uses of genetic information. These statutes are almost exclusively antidiscrimination laws that govern the behavior of insurers, employers or both. The provisions in these laws primarily address what happens to information after samples have been collected and analyzed, but a few states, such as New Jersey, included broader privacy protections by prohibiting unconsented-to collection and testing of samples generally and by defining requirements for consent to testing. Only about half a dozen states require explicit consent for sample storage, or require the destruction of samples after the purpose of their collection has been achieved.

Thus, laws that address DNA collection and banking activities do not generally apply to companies that sell genetic testing services directly to consumers. Such testing is a growth industry and includes tests for genetic diseases and susceptibilities as well as tests for non-medical purposes such as genealogical research and for marketing nutritional supplements and skin-care products to the public.

Without adequate protections for genetic privacy, individuals will not be free to discover and use genetic information for their own benefit and purposes. Laws that regulate uses of genetic information after the fact are necessary but not sufficient to achieve that goal. DNA collection, banking and analyses are expanding rapidly within the world of biomedical research and beyond. But in the absence of a comprehensive federal law addressing genetic privacy those who want to explore their genetic information may hesitate to do so, and those who do relinquish their DNA, assuming that they have control over its uses, may discover that they have given it all away. Until comprehensive laws governing DNA banking are enacted, the best that individuals can do to protect themselves is to only utilize testing services that guarantee to destroy the DNA sample on completion of the specified test.

Patricia A. Roche and George J. Annas are professors in the Department of Health Law, Bioethics and Human Rights at Boston University School of Public Health. This article is adapted from the authors' "DNA Testing, Banking and Genetic Privacy," which appeared in New England Journal of Medicine 2006; 355:545-6. George Annas is a member of the Board of the Council for Responsible Genetics.